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SUBJECT:  METI  VOICES  CONCERN  OVER  CHINA, S PROPOSED  IT 
SECURITY  CERTIFICATION  SCHEME 

Classified  By:  Ambassador  J.  Thomas  Schieffer,  for  reasons  1.4(B)  and  ( 
D)  • 

11_1 . (C)  Summary:  Recently  announced  Chinese  plans  to 

implement  a new  IT  security  certification  regime  have  set  off 
alarms  with  Japanese  government  and  industry,  according  to 
Ministry  of  Economy,  Trade,  and  Industry  (METI)  officials. 

METI  has  both  trade  and  national  security  concerns  with  the 
proposed  regulations  and  plans  to  engage  with  the  Chinese  at 
a working  level.  End  Summary. 

V2 . (C)  Deputy  Assistant  U.S.  Trade  Representative  for  China 
Tim  Wineland  and  emboffs  met  May  16  with  METI  IT  Security 
Policy  Division  Director  Ikuo  Misumi  to  share  information  and 
concerns  with  China, s intention  to  introduce  new  IT  security 
standards.  Multilateral  Trade  System  Department  Deputy 
Director,  Kenichi  Kobayashi,  Technical  Regulations  and 
Standards  Policy  Unit  Deputy  Director  Masa  Sugano,  and 
Americas  Division  Deputy  Director  Shinichi  Kihara  also 
attended.  The  meeting,  requested  by  METI,  was  the  first 
U.S. -Japan  consultation  on  the  topic  since  a March  WTO 
Technical  Barriers  to  Trade  Committee  session,  where  the 
issue  was  discussed. 

11_3 . (C)  Misumi  elaborated  on  Japan's  anticipated  trade-related 
concerns  even  though  detailed  information  on  the  scheme  is 
not  available.  These  included  the  costs  of  translation  and 
of  acquiring  certifications  and  using  marks,  as  well  as 
likely  enforcement  or  compliance  costs.  Disclosure 
requirements  may  also  cause  conflicts  when  covering  licensed 
technologies  or  information  on  third-party  components  widely 
used  in  IT  systems.  Industry  is  also  concerned  about  delays 
in  the  deployment  of  products  with  a fairly  short  market 
life,  Mismui  stated. 

11.4 . (C)  Observing  that  many  cyber  attacks  originate  in  China, 

METI  officials  then  cited  national  security  concerns 
surrounding  the  Chinese  proposal.  Misumi  pointed  to  concerns 
about  the  certification  process  and  the  confidentiality  of 
submitted  information  along  with  the  lack  of  information  and 
transparency  about  the  labs  involved,  their  affiliations  and 
their  personnel.  The  technical  documentation  involved  in 
obtaining  certification  could  be  useful  for  identifying  and 
exploiting  security  vulnerabilities  in  private  or  government 
systems  as  well  as  for  anyone  trying  to  reverse  engineer 
affected  products.  Sugino  added  related  to  these  concerns  is 
the  fact,  while  Western  labs  are  typically  independent, 
private  firms,  labs  in  China  blur  the  lines  between 
government  and  industry.  He  stressed  the  list  of 
laboratories  that  would  perform  the  proposed  certification 
were  "not  the  usual  suspects,"  which  exacerbated  Japanese 


concerns.  Finally,  the  METI  officials  emphasized  the 
unfortunate  precedent  China  sets  if  it  implements  a unique 
national  scheme,  and  the  importance  of  encouraging  use  of 
international  standards,  whether  Common  Criteria  standards  or 
FIPS. 

1[5 . (C)  Wineland  reported  the  USG  view,  as  expressed  to  the 
Chinese  government  during  meetings  in  Beijing  May  6 to  May 
14,  is  while  China's  regulations  remain  in  draft  form, 
working  level  consultations  and  dialogue  are  the  preferred 
means  of  engaging  China  on  the  issue  and  ensuring  regulations 
in  this  area  achieve  China's  legitimate  objectives  in  a 
manner  consistent  with  international  norms  and  practices. 
However,  should  China  publish  the  final  regulations  with  a 
date-certain  implementation  deadline,  this  will  necessarily 
elevate  the  issue  in  the  United  States  to  a political  level, 
given  serious  substantive  concerns  about  the  regulations  as 
well  as  past  precedent  in  the  area  of  Chinese  encryption  and 
information  security  rules.  Misumi  indicated  he  hoped  to 
travel  to  China  in  the  near  future  to  discuss  this  issue  with 
the  relevant  authorities  and  indicated  agreement  with  the  USG 
stance  to  keep  discussions  at  the  working  level  at  present. 

T_6 . (U)  DAUSTR  Wineland  has  cleared  this  message. 

SCHIEFFER 


